CN115208680B - Dynamic network risk prediction method based on graph neural network - Google Patents

Abstract

The invention discloses a dynamic network risk prediction method based on a graph neural network, which comprises the following steps: acquiring network data, constructing a network data sequence diagram, extracting a time sequence of the network data sequence diagram, obtaining a time sequence characteristic diagram, extracting network attribute characteristics, network structure characteristics and network change characteristics, learning a representation vector, obtaining a representation vector of the network data sequence diagram, constructing an anomaly detection model and predicting risks of a dynamic network; the time sequence characteristic diagram is modeled by using the diagram neural network, the structural characteristics and the attribute characteristics of the network can be extracted at the same time, so that more abnormal conditions can be excavated, the change of the dynamic network is modeled by introducing the long and short circuit memory network, the abnormality on the network change is considered in the risk prediction engineering, the accuracy of dynamic network risk prediction is improved, the actual abnormality in the network can be excavated, the prediction process is easy to operate, and the controllability is high.

Description

A Dynamic Network Risk Prediction Method Based on Graph Neural Network

technical field

The invention relates to the technical field of network risk prediction, in particular to a dynamic network risk prediction method based on a graph neural network.

Background technique

The network is composed of several nodes and links connecting these nodes, which represent the interconnection between multiple objects. In the network structure, a child node can have two or more parent nodes, and at the same time two nodes There can be two or more connections between them. Network structure data is essentially an extension of the hierarchical structure. Network structure data has received extensive attention in recent years because of its powerful representation capabilities. Networks in real life are divided into static networks and dynamic networks. In the network, the static network does not change with time, but the dynamic network will change dynamically with time. In the dynamic network, there may be some elements with changing rules or abnormal characteristics, such as communication with attack behavior.

Graph neural network is a new type of artificial intelligence neural network. Its input is graph structure data, and its output is representation vector, which is used to represent a high-level summary of property characteristics. Because graph neural network can effectively learn and mine the attribute information and structure of data features, solve tasks related to graph data in an end-to-end manner, and thus have been widely used in related applications of graph data analysis and processing.

In order to maintain the stability of the dynamic network, it is necessary to predict the risk of the dynamic network to prevent network attacks in advance. However, most of the existing dynamic network anomaly risk prediction methods are inefficient and cannot extract the structural characteristics and attribute characteristics of the network at the same time, so they cannot be fully detected. In addition, the existing risk prediction methods do not take into account the abnormality of network changes in the risk prediction process, which has a negative impact on the accuracy of network abnormality risk prediction and reduces the accuracy of dynamic network risk prediction. , it is not convenient to deploy network defense in advance, and the current research on the application of graph neural network to network anomaly detection is not deep enough to bring substantial help to the risk prediction of dynamic networks. Therefore, the present invention proposes a graph-based A neural network dynamic network risk prediction method to solve the problems existing in the prior art.

Contents of the invention

In view of the above problems, the purpose of the present invention is to propose a dynamic network risk prediction method based on a graph neural network, which can simultaneously extract the structural features and attribute features of the network by using the graph neural network to model the time-series feature graph, thereby It can dig out more abnormal situations, and model the changes of dynamic networks by introducing long-short-circuit memory networks, so that the abnormalities in network changes can be considered in risk prediction engineering, thereby improving the accuracy of dynamic network risk prediction. And it can mine the abnormalities with practical significance in the network, which solves the problems of low accuracy and low efficiency of traditional network risk prediction methods.

In order to achieve the purpose of the present invention, the present invention is achieved through the following technical solutions: a dynamic network risk prediction method based on graph neural network, comprising the following steps:

S1: Select a time period, use zero-copy packet capture technology to capture network data packets of the dynamic network to be predicted within this time period, and then standardize the data in the network data packets, and then use the standardized processed data Construct the network data sequence diagram, and then use image enhancement and image transformation to preprocess the network data sequence diagram;

S2: Extract the time series of the network data time series diagram through the frequent time series subsequence mining algorithm, and then mine the frequent time series subsequences through the extracted time series sequence to obtain the time series feature map of the network data;

S3: Select different moments first, model the time-series feature map through the graph neural network, extract the network attribute features and network structure features of the time-series feature map at different moments, and then use the long-short-circuit memory model and combine the extracted different moments Feature extraction of time series feature map Network change characteristics of time series feature map;

S4: According to the extracted network attribute features, network structure features and network change features, use the method of maximizing the mutual information between the global representation vector and the local representation vector to learn the representation vector, and obtain the representation vector of the time series feature map;

S5: Use the anomaly algorithm on the data stream to build an anomaly detection model, then use the anomaly detection model to detect anomalies in the representation vectors of the time series feature maps, and give anomalies scores, and finally predict the risk of the dynamic network based on the anomalies scores.

The further improvement is: in the above-mentioned S1, the specific method of preprocessing the network data sequence diagram by means of image enhancement and image transformation is: firstly, the network data sequence diagram is enhanced in the frequency domain by means of high-pass filtering and low-pass filtering, Then Fourier transform is used to transform the timing diagram of network data from space domain to frequency domain.

A further improvement is: in the S3, the graph neural network is a graph convolutional neural network, and the specific steps of extracting network attribute features and network structural features are: first imitating the convolution of the frequency domain on the time series feature map through the graph convolutional neural network. Product operation, and then map the time series feature map to the frequency space, after the convolution operation in the frequency space, then convert the time series feature map back to the node space, and extract the network attribute features and network structure features of the time series feature map.

The further improvement is: in the above S3, the specific steps of extracting the network change feature are: using the long-short-circuit memory recurrent neural network to model the sequence change on the time-series feature map, and then using the long-short-circuit memory network to extract the time-series feature map characteristics of network changes.

Further improvement is: in the above-mentioned S4, the specific step of performing representation vector learning is: obtain the global representation of the time-series feature map from the representation vectors of nodes and edges on the time-series feature map through a read function, and then use the method of maximizing mutual information In this way, the mutual information of the global representation vector and the mutual information of the local representation vector are maximized, and the representation vector of the time series feature map is obtained.

The further improvement lies in: in the above-mentioned S5, in the process of constructing the anomaly detection model, the network attack data in a specific time is collected from the network attack scenarios simulated by computers on different LANs as a data set, and the first half of the time in the data set is collected. The data is used as the training set to train the model, and the second half of the data is used as the test set to test the model.

The further improvement is: in the above S5, the anomaly detection model uses the robust random cut forest algorithm combined with the data structure of the robust random partition forest to perform anomaly detection on the representation vector of the time series feature map, and gives an abnormal score according to the detection result, and finally Perform dynamic network risk prediction based on anomaly scores, and deploy network defenses in advance based on the prediction results.

A further improvement is: in the above S5, an abnormal score threshold is set, and when the given abnormal score exceeds the preset threshold, it is judged that there is an abnormal risk; if the given abnormal score is within the preset threshold, it is judged as No unusual risk.

The beneficial effects of the present invention are: the present invention uses the graph neural network to model the time-series feature graph, and can extract the structural features and attribute features of the network at the same time, so that more abnormal situations can be excavated, and the long-short-circuit memory network can be introduced to Dynamic network changes are modeled, so that anomalies in network changes are considered in risk prediction engineering, thereby improving the accuracy of dynamic network risk prediction, and being able to mine meaningful anomalies in the network, and the prediction process is easy Operation and high controllability. Compared with traditional risk prediction methods, it not only improves the efficiency of risk prediction, but also improves the accuracy of risk prediction, which brings substantial help to the risk prediction of dynamic networks and facilitates users to target network risks. Deploy network defense in advance to greatly improve network security.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained according to these drawings without any creative effort.

Fig. 1 is a schematic flow chart of the method of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

Referring to Fig. 1, this embodiment provides a dynamic network risk prediction method based on a graph neural network, comprising the following steps:

S1: Select a time period, use zero-copy packet capture technology to capture network data packets of the dynamic network to be predicted within this time period, and then standardize the data in the network data packets, and then use the standardized processed data Construct the network data sequence diagram, and then use image enhancement and image transformation to preprocess the network data sequence diagram;

The specific way to preprocess the network data sequence diagram by means of image enhancement and image transformation is as follows: first, the network data sequence diagram is enhanced in the frequency domain by means of high-pass filtering and low-pass filtering, and the network data is improved by image enhancement. The clarity of the timing diagram, and then use the Fourier transform to transform the timing diagram of the network data from the spatial domain to the frequency domain, and make the image concise and effective by changing the image, which is helpful for the subsequent timing feature extraction;

The zero-copy packet capture technology is used to capture the data packets of the dynamic network, which reduces the number of data copies, improves the faster data path, and increases the network throughput, thus improving the efficiency of risk prediction;

S2: Extract the time series of the network data time series diagram through the frequent time series subsequence mining algorithm, and then mine the frequent time series subsequences through the extracted time series sequence to obtain the time series feature map of the network data;

S3: First select different times, model the time series feature map through the graph neural network, extract the network attribute characteristics and network structure features of the time series feature map at different times, and use the graph neural network to model the graph data, which can simultaneously Extracting the structural features and attribute features of the network can dig out more abnormal situations, and then use the long-short-circuit memory model, combined with the extracted features of the time-series feature maps at different times to extract the network change characteristics of the time-series feature maps, through the long-short-circuit memory network To model the change of the network, so that the abnormality of the network change is considered and added in the process of risk prediction, thereby improving the accuracy of the prediction;

The graph neural network is a graph convolutional neural network, and the specific steps for extracting network attribute features and network structural features are: first imitate the convolution operation in the frequency domain on the time series feature map through the graph convolution neural network, and then map the time series feature map to To the frequency space, after the convolution operation is performed in the frequency space, the time series feature map is converted back to the node space, and the network attribute features and network structure features of the time series feature map are extracted;

The specific steps of extracting network change features are as follows: use the long-short-circuit memory recurrent neural network to model the sequence changes on the time-series feature map, and then use the long-short-term memory network to extract the network change features of the time-series feature map;

S4: According to the extracted network attribute features, network structure features and network change features, use the method of maximizing the mutual information between the global representation vector and the local representation vector to learn the representation vector, and obtain the representation vector of the time series feature map;

The specific steps for learning the representation vector are: obtain the global representation of the time series feature map from the representation vectors of nodes and edges on the time series feature map through a read function, and then use the method of maximizing mutual information to perform global representation vector mutual information and local Represent vector mutual information maximization training to obtain the representation vector of the time series feature map;

S5: Use the anomaly algorithm on the data stream to build an anomaly detection model. The anomaly detection model uses the robust random cut forest algorithm combined with the data structure of the robust random partition forest to perform anomaly detection on the representation vector of the time series feature map, and give Finally, set an abnormal score threshold. When the given abnormal score exceeds the preset threshold, it is judged that there is an abnormal risk. If the given abnormal score is within the preset threshold, it is judged that there is no abnormal risk. And deploy network defense in advance according to the forecast results;

In the process of building an anomaly detection model, network attack data within a certain period of time are collected from computer-simulated network attack scenarios on different LANs as a data set, and the data in the first half of a certain period of time in the data set is used as a training set to train the model, and The data in the second half of the time is used as the test set to test the model.

This embodiment first collects network data and constructs a network data timing diagram, then extracts the timing sequence of the network data timing diagram and obtains the timing feature diagram, then extracts the network attribute characteristics, network structure characteristics and network change characteristics of the dynamic network, and then performs the representation vector The study and obtain the representation vector of the network sequence diagram, and finally build an anomaly detection model and predict the risk of the dynamic network, and conduct a comparative test with the existing network risk prediction method, the results show that the risk prediction method proposed by the present invention is compared with the existing The network risk prediction method is more efficient, the results are more accurate, and can be widely promoted and applied.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the scope of the present invention. within the scope of protection.

Claims (4)

1. A dynamic network risk prediction method based on graph neural network, characterized in that, comprising the following steps: S1: Select a time period, use zero-copy packet capture technology to capture network data packets of the dynamic network to be predicted within this time period, and then standardize the data in the network data packets, and then use the standardized processed data Construct the network data sequence diagram, and then use image enhancement and image transformation to preprocess the network data sequence diagram; In the above S1, the specific method of preprocessing the network data sequence diagram by means of image enhancement and image transformation is: firstly use high-pass filtering and low-pass filtering to perform frequency-domain enhancement on the network data sequence diagram, and then use Fourier The leaf transformation transforms the network data timing diagram from the spatial domain to the frequency domain; S2: Extract the time series of the network data time series diagram through the frequent time series subsequence mining algorithm, and then mine the frequent time series subsequences through the extracted time series sequence to obtain the time series feature map of the network data; S3: Select different moments first, model the time-series feature map through the graph neural network, extract the network attribute features and network structure features of the time-series feature map at different moments, and then use the long-short-circuit memory model and combine the extracted different moments Feature extraction of time series feature map Network change characteristics of time series feature map; In the above S3, the specific steps of extracting network change features are: using the long-short-circuit memory recurrent neural network to model the sequence changes on the time-series feature map, and then using the long-short memory network to extract the network change features of the time-series feature map ; S4: According to the extracted network attribute features, network structure features and network change features, use the method of maximizing the mutual information between the global representation vector and the local representation vector to learn the representation vector, and obtain the representation vector of the time series feature map; In the above S4, the specific steps of performing representation vector learning are: obtain the global representation of the time series feature map from the representation vectors of nodes and edges on the time series feature map through a read function, and then perform the global representation by maximizing mutual information Maximize training of vector mutual information and local representation vector mutual information to obtain representation vectors of time series feature maps; S5: Use the anomaly algorithm on the data stream to build an anomaly detection model, then use the anomaly detection model to detect anomalies in the representation vectors of the time series feature maps, and give anomalies scores, and finally predict the risk of the dynamic network according to the anomalies scores; In S5, the anomaly detection model uses the robust random cut forest algorithm combined with the data structure of the robust random partition forest to perform anomaly detection on the representation vector of the time series feature map, and gives an abnormal score according to the detection result, and finally performs Risk prediction of dynamic network, and deploy network defense in advance according to the prediction result. 2. A kind of dynamic network risk prediction method based on graph neural network according to claim 1, is characterized in that: in described S3, described graph neural network is graph convolutional neural network, extracts network attribute feature and network structure The specific steps of the feature are: first imitate the convolution operation of the frequency domain on the time series feature map through the graph convolutional neural network, and then map the time series feature map to the frequency space, and then perform the convolution operation in the frequency space, and then convert the time series feature map to Back to the node space, and extract the network attribute features and network structure features of the time series feature map. 3. A kind of dynamic network risk prediction method based on graph neural network according to claim 1, characterized in that: in said S5, in the process of building an abnormality detection model, network attack scenarios simulated by computers on different local area networks Collect the network attack data within a certain period of time as a data set, use the data of the first half of the time in the data set as the training set and train the model, and use the data of the second half of the time as the test set to test the model. 4. A dynamic network risk prediction method based on graph neural network according to claim 1, characterized in that: in said S5, an abnormal score threshold is set, when the given abnormal score exceeds the preset threshold It is determined that there is an abnormal risk, and if the given abnormal score is within the preset threshold, it is determined that there is no abnormal risk.

Images